Regenerate if either factory-config.gen or failure-config.gen is missing.
This should not happen, but is better to check for the result rather than
the intermediate result.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to run "resolvconf -u" at boot we need dnsmasq up and running
and startup-config having been loaded successfully. (No point when we
hare in fail secure mode.)
If this bugs out it can be pinpointed by an empty /etc/resolv.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the two /etc/os-release variables:
- IMAGE_ID
- IMAGE_VERSION
The former is configurable, with fallback to name-arch, and the latter
is only set for relase builds. During releae builds the release will
be appended to the image name.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Marvell mv88e6xxx switch driver currently used in active projects do
not support multicast router ports properly yet. Considering that Infix
do not yet have YANG support for configuring IGMP/MLD snooping, we have
decided to disable it in bridge setups by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We should only call 'error' in case loading failure-config fails, not if
loading startup-config fails. Unclear how this passed testing, must have
been a last minute change that got untested.
Found during integration in customer's br2-external.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently does not need any conditions, but may later need to check for
loaded modules and other capabilities.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Overzealous shellcheck application lead to gen-intefaces not creating a
bridge when GEN_IFACE_OPTS was uncommented in /etc/confdrc
Verified in customer br2-external.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Create per-arch unique distribution file names
- Source .gns3a information from /etc/os-release
Instead of attempting to create unique file names by hard-coding an
'infix-' prefix and extracting the "board" or "arch" part from the
defconfig, let's use the branding information from /etc/os-release
along with $BR2_ARCH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This makes it possible for projects using Infix as a br2-external to
override lots of OS-specific strings and contact information that
previously was hard coded.
The generated /etc/os-release now takes most of its data from .config
Worth noting is the changes in VERSION and BUILD_ID fields. The former
will be INFIX_RELEASE, during release builds, and the latter is always
the output from `git descibe ...`, or rather GIT_VERSION. This variable
can be overloaded as well.
See the help text and the new doc/branding.md document for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default arch and disk image filename needs to be generated
to be unique per, at least, each architecture build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Due to problems with using u-boot as loader¹ we decided to start the
system by calling the kernel image directly. The downside to that is
that, even though RAUC upgrades would work, the kernel would remain
the same.
Improvements to this are of course welcome.
________
¹) Must extract the built-in .dtb and merge with the Qemu .dtb at runtime
to be able to boot primary (or secondry) image.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling `load_cfg BR2_EXTERNAL_INFIX_PATH` from post-image.sh caused
warnings due to multiple hits in the .config file:
post-image.sh: 12: /tmp/tmp.5a3xhQQVc8: BR2_EXTERNAL_INFIX_PATH: not found
post-image.sh: 13: /tmp/tmp.5a3xhQQVc8: BR2_EXTERNAL_INFIX_PATH: not found
Let's grep for a "key.*=" instead of "key" to drop those warnings, while
still acting as a catch-all for partial matches.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes to IPv6 address origin (type 'random' rather than 'other')
now reflected in documentation.
Also using 'admin' instead of 'root' user in examples.
As we may need to load firmware to the PHYs, we can't load those
modules until we have access to the rootfs. In order for that to work,
the MDIO driver must not be built-in, as that will cause the kernel to
bind devices with missing (built-in) drivers to bind to the genphy
driver.
Therefore, build everything as modules and let udev load it during
boot.
In order get the ONIE EEPROM support and some mv88e6xxx related fixes,
move to 6.5.6, with the intention of upgrading again, to the next
longterm kernel, as soon as one becomes available.
Also, import patches from kkit-linux-6.5.y.
Everything else is named confd, even syslog messages are logged as
confd, and we've talked about not using sysrepo-plugind one day, so
let's prepare for a world where everthing is like that.
Also, and even more importantly, fix the sysrepo-plugind condition.
We cannot use <pid/syslogd>, because it can be restarted and thus
consequently Finit will stop sysrepo-plugind. This first caused a
bit of head scratching because it cause a lot of very odd errors in
the execution of sysrepo-plugind, transactions being abruptly aborted
for instace.
Whatt we can do, however, is use a static condition, which Finit has
support for since a few releases now. We want to guard the start of
our sysrepo-plugind service behind YANG /usr/libexec/confd/bootstrap.
So we can use <run/bootstrap/success>. In case the bootstrap fails,
we catch that in the row before using if:<run/bootstrap/failure> to
trigger the /usr/libexec/confd/error script (described previously).
The other run/task/services can be guarded behind <pid/confd> and now
everything suddenly makes sense.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- New script 'error' that can be overridden by a br2-external
- Call 'error' if YANG model bootstap or factory-config.gen fails
- Call 'error' if loading startup-config or failure-config fails
The 'error' script calls syslog¹ to log the error messge:
The device has reached an unrecoverable error, please RMA.
____
¹ to get a timestamp log message, and send remote in case a
br2-external has somehow hard-coded network for remote syslog
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This rather huge change is a refactor of the factory-config generataion to add
support for also generating a failure-config.
The confd bootstrap script has been given an rc file. This both eases manual
testing, when modifying the script(s), and also makes it easier to override
from a br2-external. Infix default is router/end-device, but a br2-external
may be a switch firmware and want to default to all ports in a bridge.
The generated failure-config creates a fail-safe "do no harm" config to boot
with in case startup-config for some reason is broken or cannot be applied,
e.g., bug in confd. Meaning, for both the router and switch use-cases the
device will start up with all interfaces isolated¹, with an IPv6 SLAAC (EUI64)
address per interface.
Services enabled in this fail-safe mode are: LLDP, mDNS/SD, SSH, and NETCONF.
All to facilitate diagnostics, troubleshooting and device recovery.
Other noteworthy changes include:
- rename factory/failure directories again -> factory.d/failure.d. Use
same naming as we do on target for directories holding generated files
- The bootstrap script no longer regenerates /cfg/factory.d on each boot
- The bootstrap script copies all static templates to /cfg/factory.d in
case a newer image changes the contents of them. For troubleshooting
- Support for overriding the 20-interfaces.json generation by br2-external
- Support for additional 30-config.json (ovrride/extend) by br2-external
- Expand gen-interfaces to support bridge use-case.
_____
¹ For a switch this means "no switchport", i.e., no switching between ports
otherwise connected to a switchcore (or bridge) in startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The template and scripts for generating per-device factory-config have
been spread out across the repo. This is an attempt to gather all the
pieces to a single location for better overview.
Parts of factory-config will be reused for the new fail secure mode, in
the file failure-config. The beginnings of which are in this commit.
Other changes:
- cfg-bootstrap and confd-bootstrap have been collapsed into one
- let gen-hostname + gen-interfaces save to /cfg instead of /etc,
we've moved the /etc directory to read-only storage in /usr/share
- delay start of bootstrap and sysrepo-plugind after syslogd barrier
- set 'norestart' when loading startup-confg and failure-config,
no point in retrying if that fails, just go to error immediately
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The sysklogd and BusyBox syslogd can not run at the same time. Since they
provide the same service we standardize on them providing <pid/syslogd>.
Also, ensure syslogd does not start until the fifth udevadm has completed.
This creates a barrier preventing other run/task/services from starting
too early. Thus guaranteeing a proper boot order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit fixes a regression introduced in 15572e9e where /bin/bash
was unintentionally set as the defalt /bin/sh in the system. This cause
several warnings and errors when a Bash-based /bin/sh tries to sources
/etc/profile because $SHELL identifies it as /bin/bash.
The ietf-system.yang model, with the infix-system.yang extensions,
declare a per-user SHELL that allow /bin/clish, /bin/bash, /bin/sh
and /bin/false. There should be a clear distinction between them.
This change also helps us keep bashisms away. If a script needs
Bash features, declare: #!/usr/bin/env bash
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit drops sulogin from BusyBox, as well as the Finit replacement,
in the NETCONF builds. The classic builds retain the Finit sulogin.
Furthermore, the Finit rescue mode is disabled (which uses sulogin), so
in case of trouble at boot, e.g. missing fstab or failure to fsck, the
system will no longer go to sulogin but instead log error to console and
reboot.
NOTE: the bootloader still needs to be locked down, otherwise a user
could just as easily change kernel cmdline to 'shell=/bin/sh'
Misc. reshuffle and defaults updated are due to make foo-update-defconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- with conditional execution support
- fixes to udevd and udevadm calls in renamed 10-hotplug.conf
- support for overriding internal services, e.g. dbus, keventd
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead, use the version from package/skeleton-init-finit, including the
ssh-hostkeys (previously ssh-genhostkeys) from the same package, because
it include extensive error handling and logging on failure.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The new confd-load.sh script handles bootstrapping Infix using startup-config
or a failure-config (see later commits) on error.
When used with the -b (bootstrap) option, and failure to load the give file,
the script sets a Finit condition and goes to runlevel 9. The condition can
be used to trigger loading of a failure-config to go to a Fail Secure mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only create a default startup-config from factory-config if one is missing.
Do not load an existing startup-config, that is handled by a later step in
the boot process, which needs to be monitored (and displayed) separately to
fail over to a Fail Secure mode on error.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Changes to the system concerning access rights, like users, should always
be logged, in particular when creating new users or failure to create or
modify their properties.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change addresses a problem accessing Infix over SSH. The root cause
turned out to be the hostkeys, which live in /var/lib/ssh and not in /etc
on Infix, were corrupt.
The corruption was interesting in that they all existed, but had size 0.
This state was not caught by our ssh-genhostkeys script and that is what
this change attempts to fix.
As before this change, the script starts by calling `sshd -t` to verify
they hostkeys. Unlike before we now check for 'invalid format' in the
output of that command. If any file with invalid format is found, we
remove them and regenerate the hostkeys.
In this investigation it was found that the 'ssh-keygen -A' command that
generates hostkeys does not use the directories specified for the given
files in sshd_config, instead it always saves the files to /etc/ssh.
Also, since there is no panic in getting the hostkeys generated we can
allow the script to wait for syslogd to start before we run, even though
it all happens in runlevel S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We only want Bob to run when PR's have been merged to main, this means
when something is pushed to main. (Took a while to figure this one out
actually.) See the following community discussion for details:
https://github.com/orgs/community/discussions/26724#discussioncomment-3253102
Also, we've seen that moving the 'latest' tag messes up any push/pull/sync
operation between clones and forks, so let's skip it and see how that works.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Handle IPv6 Router Advertisement (RA) based addresses.
If the last 64 bits of a link-local address is generated using the
local MAC address of the interface, i.e. a EUI-64 based address. Then
the origin is set to "link-layer".
If the addrgenmode is set to "random" instead of "eui64", then the
device will generate the interface identifier portion of the address
(the last 64 bits) randomly rather than deriving it from the MAC
address using the EUI-64 process. This will result in a "random"
origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
Setting the link MTU in Linux changes the sysctl IPV6 MTU, so we have to
set the IPv6 MTU on each run in case the IPv4 MTU changes. Hence, this
also means the IPv6 MTU must be set *after* the IPv4 (link) MTU.
statd has been updated to read the sysctl setting for IPv6 MTU.
Notice how the loopback interface is unsupported for config + status.
Fixes issue #151
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use the new fancy result-gh.md file which as github emojis. Also,
split result publishing to its own run command to simplify the YAML
file.
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: add new result file with github emojis
> 9pm.py: expose ROOT_PATH to tests via env
> lib_tcl: improve handling of extra ssh args from test
> 9pm: fix evaluation of <base> option in nested suite
> .github: publish test result md in github
> 9pm: resolve <scratch> in suite option
Signed-off-by: Richard Alpe <richard@bit42.se>
Collecting pyyaml==5.4.1 (from -r /root/pip-requirements.txt (line 6))
Downloading PyYAML-5.4.1.tar.gz (175 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 175.1/175.1 kB 16.2 MB/s eta 0:00:00
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'error'
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> [68 lines of output]
/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/config/setupcfg.py:293: _DeprecatedConfig: Deprecated config in `setup.cfg`
!!
********************************************************************************
The license_file parameter is deprecated, use license_files instead.
By 2023-Oct-30, you need to update your project and remove deprecated calls
or your builds will no longer be supported.
See https://setuptools.pypa.io/en/latest/userguide/declarative_config.html for details.
********************************************************************************
!!
parsed = self.parsers.get(option_name, lambda x: x)(value)
running egg_info
writing lib3/PyYAML.egg-info/PKG-INFO
writing dependency_links to lib3/PyYAML.egg-info/dependency_links.txt
writing top-level names to lib3/PyYAML.egg-info/top_level.txt
Traceback (most recent call last):
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 353, in <module>
main()
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 335, in main
json_out['return_val'] = hook(**hook_input['kwargs'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/root/.infix-test-venv/lib/python3.11/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", line 118, in get_requires_for_build_wheel
return hook(config_settings)
^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 355, in get_requires_for_build_wheel
return self._get_build_requires(config_settings, requirements=['wheel'])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 325, in _get_build_requires
self.run_setup()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/build_meta.py", line 341, in run_setup
exec(code, locals())
File "<string>", line 271, in <module>
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/__init__.py", line 103, in setup
return distutils.core.setup(**attrs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 185, in setup
return run_commands(dist)
^^^^^^^^^^^^^^^^^^
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/core.py", line 201, in run_commands
dist.run_commands()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 969, in run_commands
self.run_command(cmd)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/dist.py", line 989, in run_command
super().run_command(command)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/dist.py", line 988, in run_command
cmd_obj.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 318, in run
self.find_sources()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 326, in find_sources
mm.run()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 548, in run
self.add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/egg_info.py", line 586, in add_defaults
sdist.add_defaults(self)
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/command/sdist.py", line 113, in add_defaults
super().add_defaults()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 251, in add_defaults
self._add_defaults_ext()
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/command/sdist.py", line 336, in _add_defaults_ext
self.filelist.extend(build_ext.get_source_files())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "<string>", line 201, in get_source_files
File "/tmp/pip-build-env-smwadpdr/overlay/lib/python3.11/site-packages/setuptools/_distutils/cmd.py", line 107, in __getattr__
raise AttributeError(attr)
AttributeError: cython_sources
[end of output]
note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error
× Getting requirements to build wheel did not run successfully.
│ exit code: 1
╰─> See above for output.
note: This error originates from a subprocess, and is likely not a problem with pip.
The command '/bin/sh -c ~/init-venv.sh ~/pip-requirements.txt' returned a non-zero code: 1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Improved "show interfaces" information is now
reflected in IP address examples
- source info added
- IPv6 addresses shown
Also added an example with IPv6 privacy for stateless autoconfig
Manually merge PR #137, with minor updates to the YANG deviations, and
complete relocation of the new user-guide. The idea is to keep all the
documentation generic and use the docgen package later to include all
relevant parts into a PDF user guide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Like the Developer's Guide the User's Guide should be a single file on
top-level (at least for now), where it references certain sections in
other files.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Setting deviations of non-supported parts of ietf-ip
Idea is that "pyang -f tree ietf-ip.yang infix-ip.yang" should
show what we really support (and should make tests for).
Only physical interfaces have a permanent link address. So in order to
restore the default MAC generated by the kernel for interfaces such as
bridges, veth pairs, VLAN interfaces, and link aggregates, we recreate
them.
This patch adds support for checking if the phys-address attribute has
been deleted from bridge, vlan, and veth interfaces.
The netdag_must_del() function has been refactorored slightly so each
interface type is responsible for returning true if its condiitions are
satisfied.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The netconf-client Python lib currently does not support the <get-data>
RPC. This commit adds a local extension to the Device class which can
be upstreamed at a later time.
Also some added comments and disabling of pylint warnings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Override read-only flag in YANG model
- Add support for setting custom MAC
- Add support for restoring permanent/original MAC
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable privacy feature, allows true random address instead of EUI64
- Allow global addresses to use router prefix
Fixes#136
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set the IP origin "random" for avahi IPv4LL addresses. The reason we
use random and not link-layer for link-local IPv4 addresses is the
fact that they are not based on link-layer info, such as IPv6 eui64
generated LL addresses.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine copy of the current version of avahi-autoipd.action.
This script will be modified by us in later commits.
Signed-off-by: Richard Alpe <richard@bit42.se>
Modify existing IPv4 code to also add IPv6 address data to the
operational datastore. Also add support for handling link-layer IPv6
address.
IPv6 LL addresses generated with eui64 has "link-layer" origin
and random/secure generated LL addresses has "random" origin.
Signed-off-by: Richard Alpe <richard@bit42.se>
This currently includes cli-pretty tests. It could be executed
separately to clarify test results in github actions. This commit
includes it in the main test execution. The most important thing is
that it's executed.
Signed-off-by: Richard Alpe <richard@bit42.se>
It doesn't look like the regression suites updates the 9pm submodule,
in this commit we attempt to fix this.
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: print git sha sum in banner
> 9pm: add graceful check for missing suites and tests
> ssh: Spell out the full name of node properties
> ssh: Remove username from debug messages
> Merge pull request #48 from neg/execute-cleanup
Signed-off-by: Richard Alpe <richard@bit42.se>
There might be more places in confd where this is needed. This works
for the most basic use case.
The proto set here is picked up by statd and converted into a YANG
origin, which is exposed to the user.
Signed-off-by: Richard Alpe <richard@bit42.se>
Flush addresses during shutdown and renewal with new address.
This is kind of a hack and needs further testing.
Signed-off-by: Richard Alpe <richard@bit42.se>
This fixes one bug in Infix, namely that dhcp removes all other
statically configured addresses. However it introduces a new one
where dhcp renewals with new ip addresses are added as "duplicates",
we fix this in a later commit in this patchset.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a pristine version of default.script to our local board override.
The reason for this commit is to track changes we do to it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add protocol from ip route (kernel) as origin in YANG model.
Note, we control the names static and dhcp in the file rt_addrprotos.
Signed-off-by: Richard Alpe <richard@bit42.se>
This file is read by iproute2 and creates valid names for ip proto.
Such as "static" in:
ip addr add dev e0 192.168.1.1/24 proto static
Signed-off-by: Richard Alpe <richard@bit42.se>
> 9pm: add new result markdown file
> Use unique log dir for each 9pm execution
> 9pm: parse 9pm.rc file in harness
> Add new 9pm.py harness examples
> 9pm: add space between timestamp and output
> Move tcl library code to lib_tcl subdirectory
> 9pm: fix TAP skip result when not last in test
> unit_test: allow tap.yaml to be executed from cmdline
> Merge pull request #49 from kernelkit/master
Signed-off-by: Richard Alpe <richard@bit42.se>
This allows us to show empty values easier, while not affecting the
if statements.
This allows for a greater flexibility in which values are shown and
not. For example, we want to show empty columns for data that the
user adds/removes, such as IP addresses.
...
ipv4 addresses :
...
However, we don't want to show empty columns for information that
should never exist for a particular interface type.
Signed-off-by: Richard Alpe <richard@bit42.se>
The old version (bash) where slow and cluttered. This version is much
faster and easier to read / maintain.
Signed-off-by: Richard Alpe <richard@bit42.se>
This test is a "unit" test, which implies that it can be executed
locally without access to a Infix target environment.
Signed-off-by: Richard Alpe <richard@bit42.se>
The port marker is intended to be used as a hint to the
auto-factory-config generator, so that it can create a bridge for all
switch ports by default. Therefore, revert to only include ports that
devlink reports as "flavour physical".
If we want to test this functionality in QEMU, we can use Rocker, the
virtual switch, instead.
The old assumption was that only virtual links would have specific
"linkinfo" data. However, somewhere between 5.19 and 6.1, DSA ports
gained the ability to report its "conduit" interface via the
"linkinfo" attribute. That's great, but unfortunately it broke our
heuristic assumptions.
The new assumption is that only physical ports will report a
"parentbus" attribute. Let's see how long that will last :)
Our custom version has gone from being newer than Buildroot's default
to being older, so there is no reason for us override it anymore.
The kernel has become a bit more picky and will give nasty error
messages if a link's PHY connection is not explicitly defined, but
instead relies on implicit defaults. This was missing from the CPU
port of the CRB, so we supply a small patch to fix that.
When running `make legal-info` Buildroot will collect source and
licenses for all packages, which generates a few warnings for our
local packages. Local packages are skipped.
> The source code for packages that set <PKG>_REDISTRIBUTE = NO will not
> be saved. Patches that were applied are also saved, along with a file
> named series that lists the patches in the order they were applied.
Hence, setting 'foo_REDISTRIBUTE = NO' disables the warning, which seems
like a good idea to reduce the number of unnecessary questions we might
otherwise get.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bootstrap and daemon-specific helper scripts, sometimes known as foot
guns, should not be in $PATH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This unfortunately required some restructuring, and as well as extending
the run time since we have no way of sending Ethernet frames currently
in the test framework (socat would be nice).
- Put enable/disable of services before tcpdump start, LLDP lingers ...
- Extend run time: 3 -> 20 sec to catch periodic LLDP messages
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This test use NETCONF to enable/disable SSDP, it then verifies that the
DUT responds to, or does not respond to, SSDP discover messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This first version reliles on netcat (nc), mostly because that's what I
could figure out how to run in a netns. A better way would be to have a
full SsdpClient that can collect query responses properly and log all
devices found.
This, however, will do fine for verifying SSDP on/off functionality.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for enabling LLDP using the std IEEE 802.1ab
LLDP yang model. An infix-lldp model is as well to reduce the set of
available parameters to a bare minimum (enabled), for now.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
I'm sorry, I'm just so used to this modus from the previous company.
The difference to 'exit', which is available on Cisco IOS, is that it
on the top-level config context does not exit/abort to admin-exec but
instead stops.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The script resides with confd and sets up our system for confd, this
should make it easier to rememeber where it's located.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, for usability, add `name:<SVC>` to each service declaration so they
can be located more easily and/or enabled/disabled using the service they
provide.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Everything (!) potentially shared with other sysrepo plugins/daemons and
helper functions (not yet in libite) that can be used by other daemons
have been relocated to libsrx.
Fix#116
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch drops auto-enable of services we want to be able to control
via NETCONF/YANG. SSDP and mDNS/SD enable/disable configure support,
using native models, will be included in the same PR and LLDP+SNMP may
come later, using std. IEEE/IETF models, they are not critical atm.
Fix#118
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On some system, certain interfaces are not usable by an end-user. The
canonical example of this is the ethernet MAC connected to a switch,
i.e. the DSA port.
Avoid having these be picked up in the generated factory-config, which
would be confusing to a user, by classifying them as "internal" ports
to be ignored by confd and friends.
For some reason, the controller disables the bus power sometime after
it was enabled by the driver. The reference manual says, in Table 645,
about the SD_BUS_POWER bit:
> ... It will be cleared if one of the following occurs: the
> sd_bus_vlt and the voltage support in the Capabilities Register 1 do
> not match or if a card removal state was detected.
Further investigation will be needed to find the (electrical?)
root-cause of this issue.
The kernel's mounting of the rootfs may race against the underlying
device being probed - especially for media like MMC cards and USB
sticks.
Therefore, tell the kernel to wait for the root device to show up.
In the future we want to build disk images from builds where we
haven't locally built Infix, we've just downloaded an existing
release. In those cases we also have to create rauc.status, even
though we're not creating a bundle.
This is the layout expected by the "distro boot" effort in U-Boot.
As far as I understand, the contract is:
- U-Boot built for `fooboard` by `vendor`, will set the `fdtfile`
variable to `vendor/fooboard.dtb` - or more precisely: matching
whatever path the dtb is built at in the kernel tree.
- A distro (e.g. Infix) then just needs to specify the `fdtdir` in its
syslinux config (/boot in our case), and U-Boot will be able to find
the correct dtb.
Make the traditional FITs smaller by:
- Filtering out the kernel image from the rootfs, since the FIT way is
to ship it separately.
- Gzipping the kernel in the FIT, since aarch64 uses the uncompressed
"Image" format, and squashfs won't take care of it for us.
Add source, such as "ethernet" to the show ietf interfaces command.
This is translated from the somewhat obscure ietf type, such as
iana-if-type:ethernetCsmacd => ethernet
Signed-off-by: Richard Alpe <richard@bit42.se>
Replace the old "ip" output with data from the sysrepo operational
datastore. This data is piped through the new json-cfg-pretty script,
which formats the data in a nice human readable way.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add IPv4 address info from "ip addr" json to sysrepo operational
datastore.
This patch adds: MTU and ip with prefix-length.
Signed-off-by: Richard Alpe <richard@bit42.se>
The commit adds a missing description and reorders some yang statements
to meet canonical ordering according to RFC7950, section 14.
It also relocates the /interfaces/interfaces/infix-if:port augment to
its own base model that the bridge (and later lag) models reference.
Solving the bisarre ordering issues we've seen previously.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a new infix-interface-type, derived from the IANA base
type, allowing us to limit the list of supported native interface types.
Basing on IANA interface type ensure compatibility with other models,
e.g., standard/ieee/published/802.3/ieee802-ethernet-interface.yang,
which attaches itself to all interfaces of type ianaift:ethernetCsmacd.
Tested with yanglint and in Infix using ieee802-ethernet-interface.yang,
the 'ethernet' container was properly attached to interfaces of type
infixift:ethernet.
Tab completion in the CLI now lists only the supported types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This further locks down confd to fall back to /bin/false as login shell
in case of internal errors.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch restricts the possible user shells to a subset of the list in
/etc/shells, which is generated by Buildroot. The default is 'false' to
prevent accidental shell access for non-admin role users.
The default shell for the admin user is now /bin/clish, which can be
further locked down before Infix v24.02 LTS.
In case of internal error the default fallback shell is now set to the
customizable LOGIN_SHELL, which currently is /bin/bash.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The following changes have been made to condense and simplify the
leading text in the README. Tested with Grip to verify that the first
paragraph flows nicely to the left to the fine new logo. This allows
us to use the space more efficiently and the reader does not have to
scroll so long before reaching relevant content.
- Right-align logo, and shrink it a bit, to fit text to the left
- Move topic links to a foldout at the top
- Move boring licensing stuff to separate docment
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Go for something simple - Tux trapped in an RJ45 jack.
Also, remove the old versions that we don't use any more. They're in
the log if we ever need them.
This is a cleanup and reorganization of the Infix documentation.
Starting with a simplification of the top-level README, splitting
it up into several pages.
Also, fixes#100 by updating the documentation on Qemu.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also renames all klix_SYM@klinfix to SYM@infix, this is fine since we're
always calling these symbols with @infix.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Always respect the requested model to emulate. Before this change, a
device configured to run in TAP mode would ignore a user's requested
model and always emulate a e1000.
This worked on x86_64 where that driver is part of the kernel, but
that is not true for aarch64.
- Always supply a mactab. It was very confusing that the interface
names would change, in Infix, depending on the selected networking
mode.
- Remove old decoy variables that were assigned but never used
anywhere.
- Separately setup the host and target side of a nic (i.e. use a
-netdev/-device pair instead of the -nic shortcut). This lets us
share the host side setup across all modes.
This reverts an earlier change where nano was made the default editor in
a misguided attemt by yours truly to accomodate beginner users.
With the recent improvements of the CLI and the fact that the NETCONF
support has matured greatly, the need for a user-friendly editor have
diminished drastically. Editing system files is now limited to devs
and the core team prefers Mg over nano and vi.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also, add a new `quick.md` that pops up when the user types `help`.
Very quick intro to get started. Useful when we add a factory-default
motd: "Welcome to the CLI, type 'help' for a quick overview."
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync sysrepo conf settings, lots of new settings added, one removed
- Check if help topic exists
- password encrypt arguments should be optional, add SWITCH
- show datetime argument should also be optional, add SWITCH
- Trial, output factory- and startup-config colorized
- Switch to srp_prompt v2 for configure context
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The upstream help system has improved greatly. We can now rely more on
it for generating the man-page like help texts for leaf nodes. There
is also a new srp_prompt symbol that overrides the default klish one,
srp_prompt adds a '%x' format specifier for an inline path instead of
the default [edit foo bar] JunOS style two-liner.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Lots of changes upstream for parsing help texts, running as different
user, etc. Was getting too difficult to backport to tags/3.0.0, so this
resets the clock on top of (almost) the latest. Experienced issues with
the admin user in configure mode on the latest commits (e4f65d5).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is needed for the bleeding edge klish + klish-plugin-sysrepo, which
the next couple of commits will add.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Preparing for a "show system-information" as well, which still needs to
be discussed to determine contents. Some data also still missing, e.g.,
article/serial/product number db.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit switches the klish package to use the kkit branch instead of
keeping a lot of patches from the v3.0.0 release.
Most of the changes made are for dragging tinyrl into the 21st century.
It now supports most of the basic features one have come to expect from
a readline replacement: line navigation, deleting words, erasing entire
line, kill and yank of lines/words and last argument on previous line.
The history has also gotten a bit of a stern talking to. It no longer
deletes lines matching existing old ones from the history, instead it
just checks if the previous command is repeated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit changes the JunOS look of the CLI to something more akin to
a standard shell. To achieve this a %w format specifier to display the
path components is added to both klish and klish-plugin-sysrepo.
Before:
admin@infix-12-34-56:exec> configure
[edit]
admin@infix-12-34-56:configure> ediit interfaces interface eth0
[edit interfaces interface eth0]
admin@infix-12-34-56:configure> leave
admin@infix-12-34-56:exec>
After:
admin@infix-12-34-56:/> configure
admin@infix-12-34-56:/config/> edit interfaces interface eth0
admin@infix-12-34-56:/config/interfaces/interface/eth0/> leave
admin@infix-12-34-56:/> leave
However, due to unforseen problems with the naming of VIEWs in klish,
the admin-exec level "path" is hard-coded to "/" for now.
Future imporovement: fold in calling prompt@klish from srp_prompt, and
figure out why the "main" VIEW cannot be changed to "exec" without klish
just bailing out starting up.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Turns out one of the reasons some keys did not work as they should in
certain commnands, most notably the Home/End in 'less', was due to the
default TERM variable being set to 'linux'. Changing to 'xterm' fixes
this issue, works with both console and ssh login, and from testing do
not seem to have any adverse effects on existing functionality.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While spending the past couple of weeks actually trying to use the CLI,
I realized that it was very confusing to have a different behavior for
Ctrl-C than I was used to from regular shells (including the old clish
from $OLDJOB).
This change drops the Ctrl-C binding, restoring break/abort behavior,
and lets Ctrl-D be abort/exit. Pressing Ctrl-D in a sub-context in
configure calls exit, when in the top-most configure context we now
do an abort and return to admin-exec.
To apply the changes the user still has to type 'commit' or 'leave',
or tap Ctrl-Z as in the Cisco CLI.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is not just for online viewing, these markdown documents are also
made available in the CLI itself from admin-exec as:
help [introduction | keybindings | tutorial]
With this commit we also add lowdown and the real less application to
be the Infix help system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This adds support for the srp_help_text() symbol. It allows us to
display the full description for a leaf in a YANG model. This has
been added to the 'help [foo]' configure context command.
A separate admin-exec level 'help' command will be added in a later
commit. It will only be an intro to the CLI, keybindings, etc.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This restores some of the original keybindings for line manipulation
that was part of the original CLISH. They had been disabled upstream
during the UTF8 conversion and never got reimplemented.
From branch kkit on https://github.com/kernelkit/klish, the kkit branch
is based off of the 3.0.0 release. The same patches are also available
on kkit-next, which is based on the latest upstream master.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With completion support. The log command has an optional last arg,
after FILE, tail NUM, which runs tail -n NUM FILE instead of cat.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An excellent example of how to define commands with optional subcommands
and optional parameters:
password encrypt [type <md5 | sha256 | sha512>] [salt STRING] [PASSWORD]
The tricks here are two:
1. mode="switch" in the top-level password command
2. min="0" in the encrypt subcommands
The first turns the COMMAND element into a SWITCH element (with command
matching), and the second makes a COMMAND optional. If an optional
command is input by the user, then the enclosed PARAM is mandatory.
Please note, due to limitations in the mkpasswd¹ utility, spaces are not
supported in PASSWORD, i.e., when read from CLI prompt. However, spaces
are allowed when using the interactive prompt, i.e., when omitting the
PASSWORD from the CLI prompt.
¹) mkpasswd does not look for any leading ' or " in the password arg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The documentation for klish mentions the file ptypes.xml, which defines
the ptype /STRING. So let's use that instead of defining our own types.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Helper commands for quickly diagnosnig the networking subsystem after
making config changes. Should over time be replaced with operational
status from sysrepo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
An iana or infix interface type is derived from "ip link" data.
Such as loopback -> iana-if-type:softwareLoopback.
This patch adds support for the following types:
loopback, ethernetCsmacd, veth, l2vlan and bridge.
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit enables a basic sanity check of usernames in BusyBox that by
default is disabled (!). The rules enabled by this are:
- the user or group name should consist only of letters, digits,
underscores, periods, and dashes¹, and not start with a dash (as
defined by IEEE Std 1003.1-2001), or periods²
- for compatibility with Samba machine accounts, $ is supported at the
end of names
- max length of user or group name is 256 chars
Changes in this commit also includes a sync with latest BusyBox 1.36,
which adds: tree, tsort, SHA hw acceleration, and a separate script
for udhcpc6.
_____
¹) The documentation actually mentions "and at-signs" as well, but that
has been explicitly removed from the source code.
²) The documentation does not mention that leading periods are not
allowed, though this is also explicitly mentioned in the source code.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Factor out a new helper function, change_get_user(), to do the bulk of
the work for the change callbacks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add /bin/clish (symlink) to /etc/shells, as well as the traditional
/bin/{true,false} for completeness
- Validate shell string, with fallback to /bin/bash and /bin/sh
- Step infix-system revision, keeping old model in tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch bumps klish-plugin-sysrepo to get EnableNACM support. For
this to work as expected for the admin user we also need to change the
permission for the model in sysrepo.
Note: the srp_rollback() symbol has been renamed to srp_reset() upstram.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Apparently netopeer2-server expects public keys for users to be in the
canonical place (~/.ssh/authorized_keys). Infix use a custom location
in /var/run, maintained by the ietf-system plugin, which OpenSSH knows
but netopeer2-server doesn't.
It seems to be possible to add some sort of "pattern" to netopeer2 to
indicate where to look for public keys. This is added when building it
but Buildroot does not expose this as a setting. So for now, this seem
to be the least intrusive way of handling it. The owner is root, so a
malicious user cannot change the link or contents without some other
form of privilege escalation first.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
No point in leaving unused home directories lingering on the system,
also a potential security problem.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Employ the new 'adduser -d' feature where users can be created with
password login disbled instead of creating them locked by default.
This allows us to create remote users that can only access the device
using public key SSH login, which until this point was not possible.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The login applet did not know about shadow passwords, and could thus not
determine if a user accont was locked or passwordless. This caused it
to return 'login: bad salt' instead of "Login incorrect", which is the
more secure path for handling brute force attempts.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The existing 'adduser -D' command adds a locked user account, similar to
the Debian adduser --disabled-login'. This patch adds support for the
'adduser -d' command, similar to Debian 'adduser --disabled-password',
meaning login is possible but using methods other than password, e.g.,
SSH keys.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This ensures that the operstate is defined for all interface
types. Without supplying this, virtual interfaces (e.g. loopback,
dummies, tunnels) will report an "UNKNOWN" operstate. For ports backed
by physical (or virtualized) hardware, this option has no effect.
- add debug flag to trigger DEBUG() statements
- DEBUG() macro needs 'path' argument
For statd we can add support for an optional '-d' command line option to
trigger, and SIGUSR1 to toggle, debug mode. TBD for confd which still
remains to be refactored into the same standalone daemon as statd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea is to 1) map debug/error macros to syslog(), which does not
need \n, and 2) when stdout logging is used, let the macro add a \n.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows us to verify common RPC commands from within the
CLI, starting with the poweroff and reboot commands.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use timezone names defined in iana-timezones.yang, replacing
the type 'string' in standard ietf-system.yang
This enables CLI (tab complete) and NETCONF clients (dropdown)
to view available timezone strings, and the yang engine to
validate the input.
Deviation in ietf-system.yang
'replace' username type from general string to a string
with length and pattern restrictions inline with the
BusyBox 'adduser' tool.
Note, chk_sr_user_update is more restrictive, which should
be handled.
Declaring deviations for optional features for clarity regaring
extent of support.
New revision and file of infix-systems created, as earlier version
was included in infix-2023.06 release.
Please see infix-systems@2023-04-11 for history.
Support and deviations has not been checked for the included
'sub-yang-module' infix-systems-software, thus there may be
more updates to come.
two fixes
- first a typo (probably copy/paste issue)
- the sleep and 'vtysh -b' was added to make
vtysh read the /etc/frr/frr.conf file upon start(*)
sleep needed to make this happen after initctl reload
(*) See https://docs.frrouting.org/en/latest/vtysh.html#integrated-configuration-mode
But there ought to be a better way.
This patch does two main things:
1) Breaks "statd" free from "confd".
2) Introduces netlink monitoring of interfaces for sysrepo data.
Prior to this patch, sysrepo operation status was handled by code
named "statd" inside "confd". (Where confd is a sysrepo-plugin and
not a real daemon, which its name implies)
In this patch, we break out the interface part of the operational
sysrepo status, previously "statd", into a new daemon, also called
"statd".
The main reason for doing this is to avoid sysrepo threading, which
allows the new "statd" to have control over sysrepo events in the
same event pool as netlink events from the kernel. This in turn allows
statd to subscribe and unsubscribe dynamically to interfaces that
comes and goes during runtime (such as vlans).
It also makes sense that "statd" is in fact a finit daemon.
Signed-off-by: Richard Alpe <richard@bit42.se>
This allows an application to set a larger socket receive buffer size.
The default size is left unchanged (212992). 1MB is arbitrary chosen.
The main reason for this is to allow netlink kernel sockets to
hold more interface data while user-space is processing it. Typically
useful during main configuration changes where lots of kernel side
changes occur in short period of time, such as VLAN creation.
Signed-off-by: Richard Alpe <richard@bit42.se>
For some reason, the `make license-info` target complained klinfix
needed a hash file, but not the other local repos. Issue #67 tracks
adding license-info to releases, which will need some looking into,
for now this fixes the most glaring packaging oversights.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This script has some seriously sharp edges. Today two devs cut their
fingers on it trying to get new functionality in place. One when, in a
attempt at, adding an innocent status daemon, and another setting up a
client repository with a custom, enabled-by-default, daemon. In both
instances this script happily cleaned out the deamons from enabled/.
A better alternative, as described in issue #74, is to be stricter on
what is enabled by default, and for things we feel provide value in the
Classic build, maintain a separate list of symlinks in its meta board
definitiion instead.
Also, clean out previous attempt at factory-config. Now that we have
the auto-factory support in place we don't need this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In normal use-cases querierd needs a bridge with multicast-snooping
enabled to run. No point in attempting to start querierd by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- allow custom options sourced from optional /etc/default/smcrouted
- don't enable smcrouted by default when enabled in Buildroot .config
because normal use-cases require an /etc/smcroute.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use same if: syntax for release/upload job as for build job. Only thing
the upload job needs to ensure is that it does not try to upload built
artifacts from forks or from non-main builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling `make foo-rebuild` one expects all the registered hooks in
the foo package to have been called by Buildroot. The Buildroot manual
has this to say about the target-finalize hook:
> These hooks are run after all packages are built, but
> before the filesystem images are generated. They are
> seldom used, and your package probably do not need them.
The correct hook to use for target packages is POST_INSTALL_TARGET_HOOK.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Verifies that RAUC bundles can be installed using NETCONF.
We choose to not add this to the "all" suite for now, as the qeneth
topologies do not run with full disk emulation.
To test locally, configure your "make run" instance to use the UEFI
loader, launch `make run`, and then run:
make INFIX_TESTS=test/case/ietf_system/upgrade.py test-run
We were now at the point where it was completely impossible to see
which files are actually built.
Bring back some order, making future diffs easier to understand.
This let's us report the installed software versions, before any
updates have been made. Since the info should _not_ be erased in a
factory reset (since the installed software versions will not change),
move the status file to aux, which is the proper place for this class
of information.
- When running with full disk emulation (via GRUB on x86, or U-Boot on
aarch64), there's no way for us to influence the commandline passed
to the kernel, so the console is fixed to ttyS0/AMA0. Therefore,
reintroduce an option to choose the console.
- Use a fixed `nr`s for virtconsoles, so that the gdbserver always
listens on `hvc1`. Ideally, we should use udevs `/dev/virtio-ports/*`
symlinks, but for some reason these point to `/dev/vportXpY` and not
to `/dev/hvcY`. TODO: Figure out what the difference is.
- While we're here, remove the duplicated RTC setup which was
introduced with the virtio-console work a while back.
/dev/ram is accepted by the kernel during boot, but there's no actual
file with this name in /dev, so RAUC will get confused about which
slot is actually one we booted from.
Launches an interactive ipython environment, attached to Infix nodes.
This can be used as a playground for developing tests, testing out
NETCONF operations, etc.
As an example, when running meta/play, a call to a device's `_debug()`
method will enable logging of all transmitted and received NETCONF
messages, which is very useful during debugging.
As with config, the call can be described with a regular python
dictionary. As an example, to reboot the device:
target.call_dict("ietf-system", { "system-restart": {} })
To reproduce regression, before fix, in CLI from factory-default:
> configure
> set interfaces interface e0 ipv4 autoconf enable true
> leave
> shell
$ ps; ip -br a
Turns out, for some reason I cannot figure out, that we cannot use the
same pattern as for ipv6 with lydx_get_descendant(). Manually fetching
the node works though.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of relying on startup-config == factory-config we can now set
running-config to factory-config using the factory-default rpc when
we prepare for a new test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use new APIs runbg() and run_status() to call 'reboot' or 'poweroff' in
the background. This allows sysrepo + netopeer to reply to remote RPCs
before networking goes down.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prior to this patch, every new call to lydx_new_path() where "first"
was set to 1 resulted in a memory leak of 72 bytes. Typically at least
once for each sysrepo query.
The memory was allocated deep down in the lyd library, but as the
parent node wasn't set (NULL) it wasn't found by sysrepo when
cleaning up.
In this patch we mitigate this by simply removing the "first" concept,
as it doesn't appear to be needed.
Signed-off-by: Richard Alpe <richard@bit42.se>
Add a real example where we create a writable layer for container based
on a simple image.
To be able to properly start/stop and monitor containers using Finit, we
need to add the options `--systemd=false` and `--conmon-pidfile=...`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Similar to the standard build workflow, with the following exceptions:
- Sets internal variable 'ver' to ${GITHUB_REF#refs/tags/v}, for filenames
and directories, ensuring the leading 'v' in the tag is dropped
- Sets INFIX_RELEASE variable, for post-image.sh, to '$ver' so it creates
the .img files with the same name as the tarball and directory. (RELEASE
clashes with OpenSSL's release handling, breaking builds completely.)
- Sets release directory + tarball to infix-$variant-$ver, where variant
is one of "classic" or "" (for NETCONF).
- *Skips the tests*, for now. We release from main, which should already
be tested. Future releases may run a release test suite here
- Each build step (matrix) uploads its artifacts, when all build steps
have completed we start the release job (depends on build), which then
downloads all the various artifacts before creating the GitHub release
- The release notes are derived from the file ChangeLog.md. Please note,
extraction of the first release notes will fail since there is no prior
release marker in the file
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch affects the various artiact file names in release tarballs.
The files /etc/os-release and /etc/version in the image use the actual
GIT commit (git describe), as per post-build.sh
Guiding principle: artifacts without release suffix are development or
"nightly" builds. Artifacts *with* release suffix are released ones.
This drops the $GITVER from .img files for consistency with the other
artifacts, e.g. .gns3a and .pkg.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Empirical data shows response times of over 10s for even simple config
changes on heavily loaded systems (non-accelerated VMs with lots of
stress on the host). So we choose a really large number, hoping that
we won't be back here for a while.
When/If dagger generations are abandoned we should not bail out if a
recovery generation finds an existing 'order' in the previous gen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Same as with creating veth pairs, we must not try to delete both ends
since the kernel does that for us. Ensure we check skip in the current
generation and not in the next.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This should copy factory running, instead of using the factory-reset RPC
but for now we use startup since 'factory' is not yet supported as a
copy-from target.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 116, in put_config
except self.ncc.RpcError:
^^^^^^^^^^^^^^^^^
AttributeError: 'Manager' object has no attribute 'RpcError'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This one was a little bit tricky with the special yang union. To figure
out the integer value of enums one has to check the schema and deref the
correct subvalue within.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
While running tests in GitHub action, the following[1] often happens.
From the timestamp it seems unlikely to be casused by timeout, which
from what I can tell is 120 sec in the library and 30 sec on our socket.
This never happens when running locally, so I've added a simple
try-catch to retry the operation, because some[2] jobs actually pass.
2023-06-18 09:18:17 # Traceback (most recent call last):
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/case/infix_interfaces/dual_bridge.py", line 18, in <module>
2023-06-18 09:18:17 # target.put_config_dict("ietf-interfaces", {
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 117, in put_config_dict
2023-06-18 09:18:17 # return self.put_config(lyd.print_mem("xml", with_siblings=True, pretty=False))
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/home/runner/work/infix/infix/test/infamy/netconf.py", line 112, in put_config
2023-06-18 09:18:17 # self.ncc.edit_config(xml, default_operation='merge')
2023-06-18 09:18:17 # File "/root/.infix-test-venv/lib/python3.11/site-packages/netconf_client/ncclient.py", line 277, in edit_config
2023-06-18 09:18:17 # self._send_rpc(rpc_xml)
2023-06-18 09:18:17 # File "/root/.infix-test-venv/lib/python3.11/site-packages/netconf_client/ncclient.py", line 223, in _send_rpc
2023-06-18 09:18:17 # r = f.result(timeout=timeout)
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/usr/lib/python3.11/concurrent/futures/_base.py", line 456, in result
2023-06-18 09:18:17 # return self.__get_result()
2023-06-18 09:18:17 # ^^^^^^^^^^^^^^^^^^^
2023-06-18 09:18:17 # File "/usr/lib/python3.11/concurrent/futures/_base.py", line 401, in __get_result
2023-06-18 09:18:17 # raise self._exception
2023-06-18 09:18:17 # netconf_client.error.RpcError: EV ORIGIN: "rpc" ID 5 processing timed out.
2023-06-18 09:18:17 #
[1]: https://github.com/kernelkit/infix/actions/runs/5302735753/jobs/9597878647
[2]. https://github.com/kernelkit/infix/actions/runs/5302735946/jobs/9597878838
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A basic test should be just that, very basic test of a feature. So we
split out the more advanced ones, building up to the dual-bridge.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unsure if this is right, but existing nework test does not send loopback
or other interfaces in the networking configuration, so maybe merge?
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add support for uploading resulting image(s) from a job even though the
tests may have failed. This way we can inspect the image and see what
went wrong, or if it was a glitch in the matrix^W^Wazure.
Retain a symlink to images/ for test step.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The admin account is the superuser in Infix. The root account will soon
only be for running system daemons.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To set up proper factory defaults in Infix we need to drop the default
/etc/sysrepo datastores, initialized at compile-time by Buildroot when
installing netopeer2. The pre-initialized datastores cannot be set up
with new {factory} data in any other way.
The system factory-config is constructed from two parts: static data and
generated data. The latter is:
- hostname (product name + the three last octets of the base MAC)
- interface defaults (depends on number of ports on the device) that
enable IPv6 link-local on all interfaces, and
- per-device unique SSH hostkey for remote NETCONF access, requires
openssl binary on target. Can maybe use openssh for this (TODO).
The hostkeys are saved in /cfg/factory.d/ to prevent them from being
regenerated on every boot.
The script gen-hostkeys and the update of 10-netconf-server.json are
inspired by the netopeer2 scripts merge_hostkey.sh and merge_config.sh,
which do just about the same thing for regular systems.
We bootstrap sysrepo early with all the required models, netopeer2 as
well as our own, by calling sysrepoctl with initial data for {factory}
and {startup} datastores. A local patch to sysrepo is used to allow it
to look for an /etc/factory-default.json instead of compile-time default
data, the patch allows us to have variable amount of objects in the init
data, e.g. number of interface objects.
A system startup-config is generated, if one is mising, from {running}.
We then drop the initial {running} datastore before starting the daemons
sysrepo-plugind and netopeer2-server so that they, and our plugins, are
ready when we load the system startup-config.
Some sanity checks and debug possibilities:
- Ensure /etc/sysrepo exists before copying factory-config
- Keep factory-default.json for debug
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport upstream sysrepo support for initializing internal modules,
like ietf-netconf-acm, with factory-default data.
A local KernelKit patch on top is required for run-time loading from
/etc/sysrepo/factory-default.json instead of the upsream compile-time
support.
Renamed existing patches to maintain the proper patch order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The ietf-ip yang model has a global IPv4 and IPv6 'enabled' setting that
must be honored. E.g., when setting eth0 as a bridge port and disabling
IPv4 address on eth0, we must flush all addresses, including autoconf.
When detaching interface from the bridge and toggling the 'enabled' node
back on, we only get a "replaced" flag for that node, so we must restore
all addresses from the configure data. The same goes for 'autoconf'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When toggling settings like 'interfaces/interface/ipv6/enabled', which
guards both link-local and all static addresses, the operation is not
"create" or "delete", but "replace". Callback must take any "replace"
on an 'enabled' node into account since none of the other nodes will
be available in the diff.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for Linux veth pairs and is also a bit of a
cleanup of our native yang models, more on that below. The interesting
things are the use of submodule(s) for veth, and the addition of the
deviation for the deprecated /if:interfaces-state.
Unfortunately the `fprintf(ip, "link add dev %s down", ifname);` had to
be delagated from netdag_gen_afspec_add() because of this change. This
because we only know very late that the peer-end of the pair should be
skipped. Having a lingering `ip link add dev foo down` causes iproute2
to fail hard.
A note about Yang models. According to RFC they must follow the naming
standard; 'org-name' and use prefixes 'org-shortname'. So we've decided
to standardize on 'infix-modulename' and 'infix-mn', where 'modulename'
is the standard model we extend, and 'mn' is the prefix used by that
standard model. For example
- infix-interfaces extend ietf-interfaces and use infix-if
- infix-if-veth is a submodule extending infix with veth pairs
Upcoming bridge and lag models follow the same pattern. The use of
submodules require a patch to sysrepo, included earlier, and allows
us to have the same 'infix-if:', or 'infix-interfaecs:' prefix to
all ietf-interfaces extensions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When setting up veth pairs we only need to set up one end of the pair,
so the confd callback code need a way to remember to skip setting up
the peer interface.
The code added here is generic enough to handle other such transactions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the coming support for veth pairs, bridge, and link aggregates, we
need to infer peer interfaces (veth), and similar more deeply nested
data nodes to aid the user. Thereforce we can no longer rely on the
xpath in the callbacks to always be "interfaces/interface[name='ifnm']".
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This changeset includes a patch to the upstream sysrepo that is a slight
refactor of the internal function sr_install_modules_prepare_mod() that
is used by sr_install_module2(). Meaning, the srx_require_module() can
now be simplified greatly and we now also support the include statement
with submodules in yang models.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Initial yang model cleanup:
- Use infix-foo@rev.yang for augments and deviations of each std-foo model
- Drop kernelkit-infix-deviations, moved to infix-system model
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When running in the cloud, without KVM emulation, together with many
other tenants, it can take a very long time to boot the instances.
Therefore, add a meta test that will wait for all devices in the
physical topology to come up before exiting. This means that the
actual test cases that follow can assume that devices will answer
NETCONF requests.
Create topology objects that are tailored to represent topologies on
the expected format. This let's us make convenient accessors for
things like the controller node, infix devices, getting the ports used
to reach a certain device from another one, etc.
- Collect all test related targets under the test- prefix.
- Add target to run test suite against a `make run` instance. The
intended use-case is that you are testing out a new build with `make
run`, and then realize that you want to run some tests. With this
change, it is now possible to run `make infix-run-check` from a
separate terminal - which attaches to the running instance and runs
the tests.
- Provide -sh targets to spawn interactive environments, which is
useful during debugging.
- Allow the user to supply a custom suite or list of tests to be run
by 9PM.
This let's us check for timing issues in tests that arise when falling
back to TCG acceleration in QEMU.
While we're here, add a proper option to see the usage message.
busybox-extras contains an implementation of telnet, which is needed
for `qeneth console` to work. While we're updating, add tcpdump since
we'll need it sooner or later.
Add oper-status and if-index data to sysrepo for every existing
interface. The origin of the data is the "standard" ip tool with
JSON output.
Current implementation is limited to interfaces existing at startup.
Signed-off-by: Richard Alpe <richard@bit42.se>
We want Reggie to take most of the hits, then we sail in and build after
the PR has been merged so we can upload new "Nightly" images.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Keep build times low, use minimal defconfig and a single arch
- Focus on the regression testing
- Allow running on all branches for all users
Goal: when tests pass, reviews can start, if review is good, then merge
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea for this is to maintain a smallest-possible type build that can
be used to run regression tests in GitHub Actions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Primarily intended for minimal/testing images, but likely also useful
for other use-cases as well.
Defaults remain to sign all images.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a new "statd" module to sysrepo. This module is intended to handle
operational status, i.e. R/O attributes.
In this state, the statd module only retrieves and answers to the
"oper-state" of "eth0". This will be replaced by proper interface
handling and json data processing in upcoming patches. The indent here
is to get the base logistics in place as soon as possible to make life
easier for developers.
Signed-off-by: Richard Alpe <richard@bit42.se>
Since qemu.sh is now tied to the directory it's ran from, it makes
sense to change into that directory before starting to resolve any
file paths. This let's us start the script from any directory without
the need for any (cd && qemu) subshell.
This change drops Qemu menuconfig from the regular 'make menuconfig' in
favor of full release tarball support. Meaning "make update-defconfig"
will not longer cause unwanted diffs for Qemu defaults checked in when
the defconfigs are updated.
Details:
- For "make run, run-menuconfig" and bootstrapping qemu.cfg we want to
use the Buildroot menuconfig system. However, we must set the proper
environment variables for it to not overwrite our product's .config,
so the calls to conf and mconf are not pretty.
- The qemu.sh script can probably be cleaned up further, I've just set
a CONFIG_ prefix to all variables and dropped any images/ prefix vs.
the original. The CONFIG_ prefix is to make the qemu.cfg compatible
with kconfig-mconf from the kconfig-frontends package.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
First basic step, we also want a menuconfig-like way of changing the
settings, e.g., networking options.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When adding a new interface to the candidate, if the name matches
<BASE>.<VID>, infer that:
- The parent-interface is <BASE>
- The tag-type is c-vlan
- The vlan-id is <VID>
With this in place, from klish, the following sequence:
configure
set interfaces interface e0.10
leave
Will create a stacked VLAN interface, using VID 10, on top of e0.
- Make sure that when we need to delete an interface, this is done in
the exit phase of the generation we're exiting, i.e. it is treated
as a regular delete.
- When we need to delete and rebuild an interface, make sure that all
settings and addresses are applied again. This is done by swapping
out the diff for the configured data, which we just annotate with
enough metadata to make it look like a diff.
- Create a dagger dependency from the VLAN to it's parent interface.
This ensures that the parent interface is properly configured before
the VLAN is created, which is important when virtual interfaces are
stacked on top of each other. E.g. a VLAN on top of another VLAN.
- Recreate the VLAN when the parent is changed.
- Fix VLAN tag-type parsing
This makes the pattern
if (lydx_get_diff(lydx_get_child(diffnode, "attribute"), &nd)) {
/* Handle changes to "attribute" */
}
safe to use in the common case where "attribute" has not been
modified, and is therefore not present in `diffnode`.
When evolving to a new generation fails, users will typically abandon
it (so that a new attempt can be made). However, the generated
scripts and the logged output is very valuable from a debugging
perspective.
Therefore, keep the data around by just renaming the generation
directory.
Later, we can include these directories in the garbage collecting
process, if we want to.
Infix ships with a gdbserver configuration that listens on
/dev/hvc1. Connect this to gdbserver.sock on the host, so that we can
attach to or run Infix processes using GDB.
This adds support for VLAN sub-interfaces on physical interfaces, e.g.,
eth0.10 on eth0. There are no restrictions or sanity checks other than
what is defined in the YANG models.
Neither the ietf-if-extensions or the ietf-if-vlan-encapsulation model
have been ratified as standards and are thus experimental. As such, the
ietf-if-vlan-encapsulation model originally references a non-existing
revision of ieee802-dot1q-types, which has been modified to use the
latest release from IEEE.
How to set up, notice we do not use the l2vlan type:
interface eth0.10 {
type ethSubInterface;
encapsulation {
dot1q-vlan {
outer-tag {
tag-type s-vlan;
vlan-id 10;
}
}
}
parent-interface eth0;
ipv6 {
autoconf {
create-global-addresses true;
}
}
}
Unfortunately, we have to create the VLAN interface on a separate line
since adding VLAN interfaces does not allow setting addrgenmode at the
same time, hence the introduction of the new line `link set %s down`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
These packages are not (yet) used in the NETCONF build, only make sense
in the Classic Infix builds. SMCRoute will be needed later on, but not
right now, so also remove.
The dhcpcd package is only used by ifupdown-ng in Classic, in NETCONF we
use avahi-autoipd and udhcpc.
iproute2 is selected by the net tool, so collapsed by menuconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Keys stored in system specific directory /var/run/sshd/$USER.keys
- Keys are regenerated on each corresponding reconfiguration event
- Deletion of key(s) or user remove all keys
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Flip 'enabled' logic, if attribute is missing => 'enabled: false'
- Release lease on udhcpc exit
- Call initctl with -f (force) when deleting dhcp-$iface.conf otherwise
in interactive mode, waiting for (y/N)? question
- Also, always use -batch and -quiet modes with initctl
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On May 10, 2023, @troglobit wrote:
> Initial proposal for factory-config, based on example from RFC8341.
This gives the admin user the ability to configure the device over
NETCONF.
This patch adds a new user "admin" with the password "admin". The
password is hashed with sha512 ($6) as a hint to new users attempting
to change the password (avoid the weakest algorithms).
Signed-off-by: Richard Alpe <richard@bit42.se>
Initial analysis of system default users gives that there is no real
need for a default 'factory' user to trigger a factory reset. On an
actual physical device we will have a reset button or a menu option in
the bootloader to trigger factory reset, and in both physical and
virtual (GNS3) devices a logged in admin user can call the factory
command.
A virtual device that cannot be logged in to will have to be removed and
have its persistent backing store deleted, but that is the only real
downside to removing this user. The idea is to set a kernel command
line flag from the bootloader, and that could also be done from, e.g.,
GNS3.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Currently only supports creating host-device profiles, e.g. from veth
pairs or physical interfaces.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The /var, and particularly /var/lib, directories are used for persistent
storage for various system daemons. While adding support for containers
it became clear we had to change how we make these directories writable.
Both LXC and Podman use OverlayFS for the writable layer, and you cannot
set up an overlay on top of another overlay.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- package/libyang: Bump version to 2.1.55
- package/netopeer2: Bump version to 2.1.59
- package/sysrepo: Bump version to 2.2.60
- package/cni-plugins: partial backport to enable missing plugins
The libite v2.5.3 backport has been dropped from the kkit patches
since it's been merged in upstream Buildroot LTS branch.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Podman (POD manager) is an open source tool for developing, managing,
and running containers on your Linux systems.
Based on work by Christian Stewart and Nathaniel Husted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Conmon is an OCI container runtime monitor. It sits between container
runtimes, e.g., crun and runc, and userland managers, e.g., podman.
Based on work by Christian Stewart and Nathaniel Husted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This test is based on the 9pm framework, which supports execution
of test-cases written in any language. This test is written in
tcl/expect with help from the 9pm expect library. It's what I used to
test during development of the Infix basic authentication support.
The aim of this patch is to serve as an example of how the
interactiveness of the 9pm-expect library can be used.
9pm framework code is here:
https://github.com/rical/9pm
Signed-off-by: Richard Alpe <richard@bit42.se>
Rudimentary support for setting login shell for new users. Currently
hard-coded from what's selected in the Buildroot config, if Bash is
available or not.
Follow-up to f5866ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The writesf() API was hard coded to always open files in "r+" mode,
which fails if the file doesn't exist.
Add a mode option to writesf() and writedf().
Also, drop the default motd, we don't have one in NETCONF mode.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change drops -nographic in favor of the more flexible virtconsole,
fixing the problem with loss of terminal history and reset.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bringing down the current generation is a step of its own, so it makes
sense to let finit clear out all old services before setting up the
new ones.
For example, with avahi-autoipd, without this step, we would run the
following sequence when disabling it on an interface:
initctl disable zeroconf@iface
ip link set dev iface down
ip link set dev iface up
initctl reload
But we really want to stop the zeroconf service before the down/up
cycle on the interface, since that is likely to disrupt the
daemon. With this additional step, the sequence becomes:
initctl disable zeroconf@iface
initctl reload
ip link set dev iface down
ip link set dev iface up
initctl reload
Which means that finit won't try to restart zeroconf if it dies during
the down/up cycle, since the service is already gone at that point.
Saving running to startup follows the same pattern as config update of
candidate to running, so we must employ the same hook mechanism here.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Refactor register_change() wrapper, for sr_module_change_subscribe(),
with an additional twist of setting up a commit DONE event catcher.
This creates a global event hook that ensures we call 'initctl reload'
after all module callbacks have completed, regardless of the xpath and
without having to have "shadow" subscriptions to all new modules being
added to confd.
Based on on ideas from https://github.com/sysrepo/sysrepo/issues/2188
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Without --force-bind, the address is removed if another routable
address is added to the interface.
While this is likely something that should be configurable in the
future, we choose this mode as the default so that IPs used for
NETCONF connections are not dropped because other addresses are added.
A generic replacement for src/net with some advantages:
- Shell script is well-suited to these kinds of tasks, making this
implementation much simpler.
- Allow arbitrary number of actions (not just init/exit), this can be
used to implement things like `dagger exec up/down`.
- Allow arbitrary number of scripts for each action/node tuple. This
will let us handle more complex scenarios in confd without having to
fiddle about with src/net.
finit is not ready to accept the messages anyway, so we end up waiting
for the 2s timeout (2 times). Since finit won't setup a utmp entry
until it leaves runlevel S, we use that as the sync point for when
finit is ready to receive reloads.
This allows you to define a single "logical" config that can be
tailored to the specific system based on the available interfaces,
base MAC address etc.
This patch introduces basic user authentication support via sysrepo.
Namely it adds:
* The ability to create or delete a UNIX user.
* The ability to set or delete a UNIX user password.
The password needs to be hashed and in a UNIX shadow format, such as
"$ALG$SALT$HASH". We want to avoid the handling of clear text
passwords as much as possible. In the meanwhile, passwords
can be generated in the infix shell using mkpasswd.
CLI Examples:
Add a user:
configure> set system authentication user foo
Delete a user:
configure> delete system authentication user foo
Set a user password:
configure> set system authentication user foo password ...
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit enables support for running custom startup scripts at boot,
allowing a mix of a NETCONF-based system and Classic /etc. For example,
use NETCONF to set up network interfaces, users, etc. and runparts for
enabling and configuring the device as an OSPF router.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some critical services must never be stopped, and with the unfortunate
separation of runlevel S and 0 in Finit recently, all affected service
definitions must be updated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For each build there is an infix-$ARCH-$VARIANT.img -> rootfs.squash
that we want to be a real file when extracting it. This to ease the
integration with testing frameworks like Qeneth.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the introduction of the -classic defconfigs we need to also make
sure to name the resulting artifacts accordingly:
- infix-$ARCH.{gns3a,img,pkg}
- infix-$ARCH-classic.{gns3a,img,pkg}
For release builds the version (-23.02-$REV) will be appended before
the file suffix, e.g., infix-x86-64-classic-23.02-3.img
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- board/common: drop everything not needed by NETCONF mode
- board/classic: most board/common helpers relocated here
- Simplify Finit scripts for critical services
- Source variant from /etc/os-release to select ramdisk /etc
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A long standing internal debate comes to its logical conclusion. Arch
naming should follow GCC. The "native /etc" has also found a better
name: classic!
README and GitHub action has been updated accordingly.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop unused packages in NETCONF (default) mode
In the default build we will use the net tool instead of iupdown-ng,
p-net & Profeth will move to customer-specifc builds with another
licensing model.
- Split out NETCONF specific parts from board/common to board/netconf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This build is intended as a base reference and for use as a very simple
end device. The default starts DHCP and IPv4LL (ZeroConf) on eth0, but
can be configured by editing /etc/network/interfaces.d/*
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Still ways to go here, eth0 should be in a bridge with a vlan1 interface
on top, which in turn should have this config. But let's start here, it
works! :-)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The idea is to, as a plain Infix default, start up devices with DHCP and
IPv4LL/ZeroConf and IPv6 link-local address. Using mDNS the user can
then and push a NETCONF configuration over SSH.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is very ugly, what we really want is that the commit_done_hook()
runs when *all* DONE events have been processed in all models. The
side-effect of this hack is that the callback is run twice, both for
ietf-systm and ietf-interfaces if both are modified.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds a first Infix model to augment ietf-ip with a node,
similar to the IPv6 'autoconf' node, also for IPv4. For IPv6 the
autoconf feature comes built-in, for IPv4 it is defined in RFC3927.
The setting behaves the same as for IPv6, but in the case of IPv4 we
enable avahi-autoipd per interface to acquire the 169.254/16 address.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the new templating support in Finit, and this patch, we can now
very easily enable a ZeroConf service on, e.g., eth0:
$ initctl enable zeroconf@eth0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The root user is by default not allowed to log in over SSH, so we add an
admin user with limited root privileges for this purpose.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When calling 'make skeleton-init-finit-rebuild' to (re)install any new
or modified services, we cannot remove everything installed already.
That breaks what other packages may have installed already and is not
the Buildroot way.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The init_next_gen() function moves us to the next generation, as well as
intialize all data files for expected interfaces in that generation.
However, bridge and lag interfaces have dependendcies that need to be
moved as well. It is only the test author that knows the expected new
state, so this function only sets up the desired state, without ever
looking at what any previous generation looked like.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With more advanced interface types we cannot use create_iface() to set
up the file structure in new generations. This commit adds a _data()
function that should be used instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The net tool traverses the graph and executes the scripts et al in
postorder, i.e., all leaves are evaluated first before the parent's
script is run. Hence, attaching ports to a bridge or link aggregate
is the responsibility of the parent, not the leaves.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For instance, when adding ip command to the ip pipe we need the kernel
to execute those commands before the bridge command pipe is executed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Host tools and target are often out of sync, sometimes because we need
to run a newer version of iproute2 with more features. By installing
tests to target we can still verify basic functionality, provided the
tests verify their dependencies and exit 77 (SKIP).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Simplify build process, including cross compilation
- Add basic test framework, available as `make check`
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Run with unshare, as so:
make clean; make; cd test/
unshare -mrun ./three-independent.sh
This sets up a test directory in /tmp/net, creates three independtent
interface configs for dummy interfaces. Activates the config with a
call to `net -vd apply`, and then verifies the result using a mix of
ip link/addr and jq magic.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling net prevsiouly meant `net do`, the new separation is to be able
to add `net up` and `net down` commands, with optional interface args.
The idea is to support the same semantics as `ifup -a` of `ifup foo`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Naming the actions after their executing entity, e.g., foo.sh when it is
executed by /bin/sh, is a tried and true paradigm.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When taking down a network setup, it needs to be deconstructed using the
foo.exit rules of the previous generation, and in reverse dependency
order.
This patch adds support for generating the deps when bringing up the
network setup, and saving an rdeps file in that generation, which can
be used later when moving leafs between nodes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This means that:
- The full boot order is now respected, using the magic "fallback"
varible in GRUB. This means that if an entry fails to load, we move
on to the next one in the defined order.
- Netbooting is supported. In this mode, GRUB will acquire an IP
address using DHCP, after which it downloads an image using TFTP.
- If we run out of valid entries, we always make sure to reboot. This
ensures that, e.g., a temporary TFTP server outage does not cause an
Infix device to get stuck in GRUB.
At the moment, the image handling is excruciatingly inefficient when
netbooting, as the image is downloaded multiple times behind the
scenes. Ideally, downloads would be cached, but a quick investigation
indicates that an implementation of this would take more time than we
can spare at the moment. Therefore, we settle for the working, though
wasteful, implementation.
The per-interface and per-af setting in the ietf-ip yang module allow
the user to enable a more granular forwarding between interfaces, which
is disabled by default.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of having to rely on the kernel command line, we convert all the
kernel functionality in question into modules and rely on the auto-load
feature in the kernel and modprobe to add options at load time.
The fb_tunnels setting is a net core setting, for that we use sysctl.
This commit also syncs the kernel config between our two main archs,
disabling DRM and SOUND for the Amd64 build as a spin-off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling sr_get_time() for an xpath that has no data causes sysrepo to
always log the access as an error. With sr_get_items() it is left to
the callee to determine if the missing data should cause an error.
This patch is a refactor that silences the syslog message and also
fixes one or tow memory leaks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Some users still prefer the old netmask style to set up an interface.
This patch enables the corresponding model feature and checks for a
netmask only if prefix-length is unset.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All value functions, except the new srx_enabled(), now return clear
error indication, with the value as a separate argument.
The srx_enabled() predicate function is for cases where the default
value is disabled and code checks enable a subsystem or flag. I.e.,
when an error can safely be returned as 'false'.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Note: new API, srx_get_bool() returns -1 on error, leaving 0 and 1 as
false and true, respectively.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Unfortunately, sysrepo considers it an error to load a module that is
already loaded, ruling out using `sr_install_modules`.
Therefore, provide `require_modules` instead, which ensures that a
given set of modules are loaded, or loads them otherwise.
Things we really want later, but don't use right now:
- MRP
- MSTP
Neat to have in a networking product, but not used at all by us atm:
- ttyd
- tmux
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add the ability to set and delete system MotD (Message Of The Day)
using the cli.
This patch augments the standard ietf-system yang schema with
a new infix-system schema which contains a new motd leaf.
The default value is hard coded in two places, confd and the rootfs
file /etc/motd. The intention is to fix this in upcoming patches.
Introduces:
exec> configure> set system motd STRING
exec> configure> delete system motd
This is needed to confirm the new system configuration generation and
reload all affected services. E.g., when configuring an NTP server
and committing the candidate to running, the ietf-system plugin has
only enabled the service, as a last step we need to tell Finit to
actually start it.
This hook needs to run last since the enabled service(s) may depend on
other service(s), or networking, to be enabled in the proper order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Really ugly handling here, needs to be reworked into sr_uint8() etc.,
adding as-is for big upcoming demo.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Declare deviation for /ietf-system:system/clock/timezone-utc-offset,
which we currently do not support.
Please note, when setting out to add support for timezone-utc-offset,
you need to ensure the user does not input both, that should be a
validation error. It's an either-or thing.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
How to verify, use the following command and paste the XML below:
$ sysrepocfg -R
<sys:set-current-datetime xmlns:sys="urn:ietf:params:xml:ns:yang:ietf-system">
<sys:current-datetime>2022-01-12T14:29:00-02:00</sys:current-datetime>
</sys:set-current-datetime>
Reuse code from mech, verified and working.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When researching the systemd tmpfiles.d implementation I discovered the
effort to standarize on /usr/share/factory as a generic factory defaults
for Linux systems. This patch adds a small example factory.cfg file
that is installed as /usr/share/factory/cfg/startup-config.cfg. The
tmpfiles.d backend will then install it as /cfg/startup-config.cfg if
that file is missing at boot. Confd does the rest to bootstrap our
(by default) empty sysrepo db with this startup-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds a hook to the startup datastore, we use the ietf-system
module because the module argument is mandatory. The hook runs when all
changes have been saved to the internal store. Since sysrepo has many
startup files in /etc/sysrepo, we saving a JSON copy of all these files
in /cfg/startup-config.cfg, which is persistent. On system bootstrap
this file is merged into the (empty) running datastore, which is what
the sysrepo maintainers recommend to be independent of any yang model
updates that might occur on image upgrades.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Call external programs safely with run()
- Use augeas to update /etc/hostname and /etc/hosts
- Add support for generating /etc/chrony.conf
- Update license copyright due to significant contrib.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default is to use -d (debug), which changes logging to stdout, which
we do not want with Finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2023-04-02 16:24:08 +02:00
533 changed files with 39122 additions and 17692 deletions
echo">> Disk image MD5: $(md5sum "$BINARIES_DIR/$DISK"| awk '{print $1}')"
cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
{
"name": "$NM",
"category": "router",
"description": "Infix is a Network Operating System based on Linux. It can be set up both as a switch, with offloading using switchdev, and a router with firewalling.",
"vendor_name": "KernelKit",
"vendor_url": "https://github.com/kernelkit/",
"product_name": "Infix",
"description": "$INFIX_DESC",
"vendor_name": "$VENDOR_NAME",
"vendor_url": "$VENDOR_HOME",
"product_name": "$NAME",
"registry_version": 6,
"status": "stable",
"maintainer": "KernelKit",
"maintainer_email": "kernelkit@googlegroups.com",
"usage": "Default login is 'root', no password.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
"maintainer": "$VENDOR_NAME",
"maintainer_email": "${SUPPORT_URL#mailto:}",
"usage": "Default login, user/pass: admin/admin\n\nType 'help' for an overview of commands and relevant configuration files.\n\nFor Classic builds the following applies: the /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
